@mcp-use/client 2.0.0-beta.13 → 2.0.0-beta.14

package/dist/index.d.ts

@@ -8,7 +8,7 @@
 import "./telemetry/configure-node.js";
 export { auth, UnauthorizedError } from "@modelcontextprotocol/client";
 export { completeOAuthFlow, isUnauthorized } from "./auth/flow.js";
-export { createOAuthProvider, NodeOAuthClientProvider, OAuthFlowError, type NodeOAuthOptions, type OAuthProviderOptions, } from "./auth/node.js";
+export { createOAuthProvider, NodeOAuthClientProvider, OAuthFlowError, type NodeOAuthAuthorizationResponse, type NodeOAuthOptions, type OAuthProviderOptions, } from "./auth/node.js";
 export { FileKVStore } from "./auth/storage-file.js";
 export * from "./core/config.js";
 export * from "./core/node.js";

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,+BAA+B,CAAC;AAEvC,OAAO,EAAE,IAAI,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AACvE,OAAO,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AACnE,OAAO,EACL,mBAAmB,EACnB,uBAAuB,EACvB,cAAc,EACd,KAAK,gBAAgB,EACrB,KAAK,oBAAoB,GAC1B,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AACrD,cAAc,kBAAkB,CAAC;AACjC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,mBAAmB,CAAC;AAGlC,cAAc,qBAAqB,CAAC;AACpC,cAAc,qBAAqB,CAAC;AACpC,cAAc,sBAAsB,CAAC;AAGrC,cAAc,kCAAkC,CAAC;AAGjD,cAAc,0BAA0B,CAAC;AAGzC,OAAO,EACL,kBAAkB,EAClB,iBAAiB,EACjB,GAAG,EACH,SAAS,EACT,QAAQ,EACR,cAAc,EACd,YAAY,EACZ,eAAe,GAChB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,+BAA+B,CAAC;AAEvC,OAAO,EAAE,IAAI,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AACvE,OAAO,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AACnE,OAAO,EACL,mBAAmB,EACnB,uBAAuB,EACvB,cAAc,EACd,KAAK,8BAA8B,EACnC,KAAK,gBAAgB,EACrB,KAAK,oBAAoB,GAC1B,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AACrD,cAAc,kBAAkB,CAAC;AACjC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,mBAAmB,CAAC;AAGlC,cAAc,qBAAqB,CAAC;AACpC,cAAc,qBAAqB,CAAC;AACpC,cAAc,sBAAsB,CAAC;AAGrC,cAAc,kCAAkC,CAAC;AAGjD,cAAc,0BAA0B,CAAC;AAGzC,OAAO,EACL,kBAAkB,EAClB,iBAAiB,EACjB,GAAG,EACH,SAAS,EACT,QAAQ,EACR,cAAc,EACd,YAAY,EACZ,eAAe,GAChB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC"}

package/dist/index.js

@@ -802,6 +802,8 @@ var init_connection_manager = __esm({
       _connection = null;
       _task = null;
       _abortController = null;
+      _startPromise = null;
+      _stopPromise = null;
       constructor() {
         this.reset();
       }
@@ -811,10 +813,21 @@ var init_connection_manager = __esm({
        * @returns The established connection.
        * @throws If the connection cannot be established.
        */
-      async start() {
+      start() {
+        if (this._stopPromise) {
+          return this._stopPromise.then(() => this.start());
+        }
+        if (this._startPromise) return this._startPromise;
         this.reset();
         logger.debug(`Starting ${this.constructor.name}`);
         this._task = this.connectionTask();
+        this._startPromise = this.waitUntilReady().catch((error) => {
+          this._startPromise = null;
+          throw error;
+        });
+        return this._startPromise;
+      }
+      async waitUntilReady() {
         await this._readyPromise;
         if (this._exception) {
           throw this._exception;
@@ -827,7 +840,18 @@ var init_connection_manager = __esm({
       /**
        * Stop the connection manager and close the connection.
        */
-      async stop() {
+      stop() {
+        if (this._stopPromise) return this._stopPromise;
+        if (!this._task) return Promise.resolve();
+        const trackedStop = this.stopTask().finally(() => {
+          if (this._stopPromise === trackedStop) {
+            this._stopPromise = null;
+          }
+        });
+        this._stopPromise = trackedStop;
+        return trackedStop;
+      }
+      async stopTask() {
         if (this._task && this._abortController) {
           logger.debug(`Cancelling ${this.constructor.name} task`);
           this._abortController.abort();
@@ -842,6 +866,8 @@ var init_connection_manager = __esm({
           }
         }
         await this._donePromise;
+        this._task = null;
+        this._startPromise = null;
         logger.debug(`${this.constructor.name} task completed`);
       }
       /**
@@ -1108,7 +1134,7 @@ init_connector_telemetry();
 init_logging();
 
 // src/utils/version.ts
-var VERSION = "2.0.0-beta.13";
+var VERSION = "2.0.0-beta.14";
 function getPackageVersion() {
   return VERSION;
 }
@@ -1128,16 +1154,13 @@ var MCPAgentExecutionEvent = class extends BaseTelemetryEvent {
     return {
       // Core execution info
       execution_method: this.data.executionMethod,
-      query: this.data.query,
       query_length: this.data.query.length,
       success: this.data.success,
       // Agent configuration
       model_provider: this.data.modelProvider,
       model_name: this.data.modelName,
       server_count: this.data.serverCount,
-      server_identifiers: this.data.serverIdentifiers,
       total_tools_available: this.data.totalToolsAvailable,
-      tools_available_names: this.data.toolsAvailableNames,
       max_steps_configured: this.data.maxStepsConfigured,
       memory_enabled: this.data.memoryEnabled,
       use_server_manager: this.data.useServerManager,
@@ -1148,8 +1171,6 @@ var MCPAgentExecutionEvent = class extends BaseTelemetryEvent {
       // Execution results (always include, even if null)
       steps_taken: this.data.stepsTaken ?? null,
       tools_used_count: this.data.toolsUsedCount ?? null,
-      tools_used_names: this.data.toolsUsedNames ?? null,
-      response: this.data.response ?? null,
       response_length: this.data.response ? this.data.response.length : null,
       execution_time_ms: this.data.executionTimeMs ?? null,
       error_type: this.data.errorType ?? null,
@@ -1245,21 +1266,72 @@ async function telFetch(url, init) {
 }
 var POSTHOG_HOST = "https://eu.i.posthog.com";
 var POSTHOG_API_KEY = "phc_lyTtbYwvkdSbrcMQNPiKiiRWrrM1seyKIMjycSvItEI";
-function capturePostHog(params) {
-  const host = params.host ?? POSTHOG_HOST;
-  const apiKey = params.apiKey ?? POSTHOG_API_KEY;
-  return telFetch(`${host}/i/v0/e/`, {
-    method: "POST",
-    headers: { "Content-Type": "application/json" },
-    keepalive: true,
-    body: JSON.stringify({
+var CONTENT_PROPERTY = /(^|_)(arguments?|args|body|command|headers?|location|message|query|response|secret|subject|token|uri|url|user_agent)(_|$)/i;
+var IDENTIFYING_PROPERTY = /(^|_)(server_identifiers?|server_names?|servers|tool_names?|tools_(available|used)_names)(_|$)/i;
+var AGGREGATE_PROPERTY = /(_count|_length|_duration(?:_ms)?|_time_ms|(^|_)num_[a-z0-9_]+)$/i;
+function normalizePropertyKey(key) {
+  return key.replace(/([a-z0-9])([A-Z])/g, "$1_$2").replace(/[^a-z0-9_$]+/gi, "_").toLowerCase();
+}
+function sanitizeValue(value, seen) {
+  if (Array.isArray(value)) {
+    if (seen.has(value)) {
+      throw new TypeError("Cyclic telemetry properties are not supported");
+    }
+    seen.add(value);
+    const sanitized = value.map((item) => sanitizeValue(item, seen));
+    seen.delete(value);
+    return sanitized;
+  }
+  if (value !== null && typeof value === "object" && (Object.getPrototypeOf(value) === Object.prototype || Object.getPrototypeOf(value) === null)) {
+    if (seen.has(value)) {
+      throw new TypeError("Cyclic telemetry properties are not supported");
+    }
+    seen.add(value);
+    const sanitized = sanitizeProperties(
+      value,
+      seen
+    );
+    seen.delete(value);
+    return sanitized;
+  }
+  return value;
+}
+function sanitizeProperties(properties, seen = /* @__PURE__ */ new WeakSet()) {
+  const sanitized = {};
+  for (const [key, value] of Object.entries(properties)) {
+    const normalizedKey = normalizePropertyKey(key);
+    if (AGGREGATE_PROPERTY.test(normalizedKey)) {
+      if (value === null || typeof value === "number") {
+        sanitized[key] = value;
+      }
+      continue;
+    }
+    if (IDENTIFYING_PROPERTY.test(normalizedKey) || CONTENT_PROPERTY.test(normalizedKey)) {
+      continue;
+    }
+    sanitized[key] = sanitizeValue(value, seen);
+  }
+  return sanitized;
+}
+async function capturePostHog(params) {
+  try {
+    const host = params.host ?? POSTHOG_HOST;
+    const apiKey = params.apiKey ?? POSTHOG_API_KEY;
+    const body = JSON.stringify({
       api_key: apiKey,
       event: params.event,
       distinct_id: params.distinctId,
-      properties: params.properties,
+      properties: sanitizeProperties(params.properties),
       timestamp: (/* @__PURE__ */ new Date()).toISOString()
-    })
-  });
+    });
+    await telFetch(`${host}/i/v0/e/`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      keepalive: true,
+      body
+    });
+  } catch {
+  }
 }
 
 // src/telemetry/telemetry.ts
@@ -1789,11 +1861,12 @@ async function completeOAuthFlow(provider, serverUrl, options = {}) {
       throw new Error(`Unexpected OAuth auth() result: ${result}`);
     }
   }
-  if (typeof flowProvider.getAuthorizationCode === "function") {
-    const code = await flowProvider.getAuthorizationCode();
+  if (typeof flowProvider.getAuthorizationResponse === "function" || typeof flowProvider.getAuthorizationCode === "function") {
+    const response = typeof flowProvider.getAuthorizationResponse === "function" ? await flowProvider.getAuthorizationResponse() : { code: await flowProvider.getAuthorizationCode() };
     await auth(provider, {
       serverUrl,
-      authorizationCode: code,
+      authorizationCode: response.code,
+      ...response.iss !== void 0 ? { iss: response.iss } : {},
       fetchFn
     });
     return;
@@ -1807,6 +1880,8 @@ async function waitForBrowserAuthComplete(provider, timeoutMs) {
     );
   }
   if (provider.useRedirectFlow) {
+    await new Promise(() => {
+    });
     return;
   }
   const tokensKey = provider.getKey?.("tokens");
@@ -1823,25 +1898,29 @@ async function waitForBrowserAuthComplete(provider, timeoutMs) {
     } catch {
     }
   }
-  const result = await runAuthPopup({
-    popup: null,
-    state,
-    tokensKey,
-    timeoutMs
-  });
-  switch (result.kind) {
-    case "success":
-      return;
-    case "cancelled":
-      throw new Error("OAuth authentication was cancelled.");
-    case "timeout":
-      throw new Error(
-        `OAuth callback not received within ${timeoutMs}ms. Ensure /oauth/callback calls onMcpAuthorization().`
-      );
-    case "error":
-      throw new Error(result.error);
-    default:
-      throw new Error("Unexpected OAuth popup result");
+  try {
+    const result = await runAuthPopup({
+      popup: null,
+      state,
+      tokensKey,
+      timeoutMs
+    });
+    switch (result.kind) {
+      case "success":
+        return;
+      case "cancelled":
+        throw new Error("OAuth authentication was cancelled.");
+      case "timeout":
+        throw new Error(
+          `OAuth callback not received within ${timeoutMs}ms. Ensure /oauth/callback calls onMcpAuthorization().`
+        );
+      case "error":
+        throw new Error(result.error);
+      default:
+        throw new Error("Unexpected OAuth popup result");
+    }
+  } finally {
+    provider.markFlowComplete?.();
   }
 }
 
@@ -2207,7 +2286,7 @@ var OAuthSessionStore = class _OAuthSessionStore {
    */
   async storeAuthorizationState(authorizationUrl, opts = {}) {
     const state = globalThis.crypto.randomUUID();
-    const stateKey = `${this.storageKeyPrefix}:state_${state}`;
+    const stateKey = `${this.storageKeyPrefix}_${this.serverUrlHash}_state_${state}`;
     const stateData = {
       serverUrlHash: this.serverUrlHash,
       expiry: Date.now() + 1e3 * 60 * 10,
@@ -2316,7 +2395,7 @@ var NodeOAuthClientProvider = class _NodeOAuthClientProvider {
   server = null;
   /** Currently in-flight deferred — used to prevent overlapping flows. */
   pending = null;
-  /** Latest deferred (settled or in-flight) — what `getAuthorizationCode()` returns. */
+  /** Latest deferred (settled or in-flight) for the loopback response. */
   lastFlow = null;
   pendingTimer = null;
   constructor(serverUrl, port, session, kv, options) {
@@ -2443,15 +2522,25 @@ var NodeOAuthClientProvider = class _NodeOAuthClientProvider {
   }
   /**
    * Resolves with the authorization code captured by the loopback callback.
+   *
+   * @remarks This compatibility method omits the RFC 9207 issuer. OAuth flow
+   * orchestrators should use {@link getAuthorizationResponse} when available.
    * Must be called after `redirectToAuthorization()`. Returns the same
    * promise whether the callback has fired or not — callers may subscribe
    * before or after.
    */
   getAuthorizationCode() {
+    return this.getAuthorizationResponse().then((response) => response.code);
+  }
+  /**
+   * Resolves with the authorization code and RFC 9207 issuer captured by the
+   * loopback callback.
+   */
+  getAuthorizationResponse() {
     if (!this.lastFlow) {
       return Promise.reject(
         new Error(
-          "NodeOAuthClientProvider.getAuthorizationCode() called before redirectToAuthorization()"
+          "NodeOAuthClientProvider.getAuthorizationResponse() called before redirectToAuthorization()"
         )
       );
     }
@@ -2506,11 +2595,11 @@ var NodeOAuthClientProvider = class _NodeOAuthClientProvider {
       this.server = null;
     }
   }
-  resolvePending(code) {
+  resolvePending(response) {
     const p = this.pending;
     this.pending = null;
     this.stopLoopback();
-    p?.resolve(code);
+    p?.resolve(response);
   }
   rejectPending(err) {
     const p = this.pending;
@@ -2527,6 +2616,7 @@ var NodeOAuthClientProvider = class _NodeOAuthClientProvider {
     }
     const code = url.searchParams.get("code");
     const state = url.searchParams.get("state");
+    const iss = url.searchParams.get("iss") ?? void 0;
     const err = url.searchParams.get("error");
     const errDesc = url.searchParams.get("error_description") ?? void 0;
     if (err) {
@@ -2544,7 +2634,7 @@ var NodeOAuthClientProvider = class _NodeOAuthClientProvider {
     res.statusCode = 200;
     res.setHeader("content-type", "text/html; charset=utf-8");
     res.end(SUCCESS_HTML);
-    this.resolvePending(code);
+    this.resolvePending({ code, ...iss !== void 0 ? { iss } : {} });
   }
 };
 async function defaultOpener(url) {